Complementary user entity controls (CUECs) are controls that a service organization assumes its customers, called user entities, will have in place so that the service organization's controls can meet the stated criteria or control objectives.
CUECs are listed in a vendor's SOC report, usually in or alongside the system description. They tell customers which parts of the control environment are their responsibility, not the vendor's.
In simple terms, CUECs answer:
- What does the vendor expect its customers to do?
- Which criteria depend on those customer actions?
- Which controls should the customer have in place before relying on the vendor's report?
Why CUECs Matter
A SOC 2 report describes the service organization's controls. Many of those controls only work fully if the customer does its part. For example, a SaaS vendor can enforce password and multi-factor authentication settings, but the customer usually decides who gets an account and when that account is removed.
CUECs matter because:
- A clean SOC 2 opinion assumes the CUECs are in place at the customer.
- If a customer ignores CUECs, the vendor's controls may not protect the customer's data as described.
- Customers who rely on a vendor's report in their own audits are often asked how they addressed the CUECs.
Common Examples of CUECs
CUECs vary by service, but common examples include:
- The user entity grants, reviews, and removes its own users' access to the service.
- The user entity notifies the service organization promptly when an authorized contact leaves.
- The user entity protects its own credentials and API keys used to access the service.
- The user entity configures security features the service makes available, such as MFA or single sign-on.
- The user entity reviews reports or alerts the service provides and acts on them.
- The user entity is responsible for the accuracy of the data it submits.
CUECs vs Related Terms
| Term | Who performs the control | Where it appears |
|---|---|---|
| CUECs | The customer (user entity) | The vendor's SOC report |
| Complementary subservice organization controls (CSOCs) | The vendor's own vendors, such as a cloud provider | The vendor's SOC report, for subservice organizations carved out of scope |
| Key control | The service organization | The vendor's controls tested by the auditor |
| Compensating control | Whoever owns the risk | Used when a primary control is missing or weak |
For more on how subservice organizations and CUECs fit together, see Subservice Organizations and CUECs in SOC 2.
How Customers Should Handle CUECs
When you review a vendor's SOC report as part of vendor management:
- Find the CUEC list in the report.
- Decide which CUECs apply to how you use the service.
- Map each applicable CUEC to a control you already run, such as a user access review or offboarding procedure.
- Note any gaps and assign an owner to close them.
- Keep a record of that mapping with your vendor review.
How Service Organizations Should Write CUECs
If you are the service organization:
- Keep CUECs specific to real customer responsibilities.
- Do not use CUECs to shift your own control responsibilities to customers.
- Make sure CUECs match your contracts, documentation, and product settings.
- Review CUECs when the service changes.
Common Mistakes
- Customers filing a vendor's SOC report without reading the CUECs
- Assuming the vendor handles user access for the customer's own accounts
- Vendors listing generic CUECs that do not match the service
- Never revisiting CUEC mappings after a vendor's report changes
How AuditFlo.co Helps
AuditFlo.co helps teams retain continuous evidence collection and audit-period history for operational artifacts when those records are stored or linked through connected systems and workflows your team already uses, such as GitHub and Jira.
For CUECs, that can mean records from controls you mapped to a vendor's CUECs, such as access reviews and offboarding tickets, are easier to find when your own auditor asks. AuditFlo.co does not evaluate vendor reports, does not issue SOC 2 reports, does not certify compliance, and does not replace auditors.
To see the workflow for your stack, request a demo.
Key Takeaway
CUECs are the controls a vendor's SOC report assumes its customers perform. If you rely on a vendor's report, read the CUECs, map them to your own controls, and keep evidence that those controls run.